NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-08-27 20:40:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): pass user.token_version when generating temp JWT from API key

Browse Source 
_resolve_token generated a temp JWT with a hardcoded ver=0 after
validating the API key. Users who had logged out at least once
(token_version >= 1) would hit "Token has been revoked" 401 on
every MCP tool call, because the REST auth chain rejects ver=0
when the user's token_version no longer matches.

Fix: pass the user's actual token_version to create_access_token
so the temp JWT carries the correct ver claim.
This commit is contained in:
YueGuobin 2026-07-15 14:28:16 +08:00
parent 01d72aed9a
commit 89e11d265f
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
gns3server/api/routes/mcp/__init__.py
View File

@ -233,7 +233,7 @@ async def _resolve_token(token: str) -> str | None:
user = await user_repo.get_user(db_key.user_id)
if user:
_jwt_username_var.set(user.username)
fresh_token = auth_service.create_access_token(user.username)
fresh_token = auth_service.create_access_token(user.username, token_version=user.token_version)
return fresh_token
except Exception:
pass